CVE-2026-79271: Google Chrome DOM Information Disclosure

CVE-2026-79271 Overview

CVE-2026-79271 is an information disclosure vulnerability in the Document Object Model (DOM) implementation of Google Chrome prior to version 152.0.7977.65. A remote attacker can obtain sensitive information from the browser by convincing a user to visit a crafted HTML page. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Google rated the Chromium security severity as Medium. Exploitation requires user interaction through social engineering, which limits the attack surface but still enables cross-origin data leakage from within the browser process.

Critical Impact
A remote attacker leveraging social engineering can leak sensitive DOM-resident data from a victim's browser via a crafted HTML page.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers that incorporate the same upstream DOM code prior to the fix
End-user workstations running the vulnerable Chrome build across Windows, macOS, and Linux

Discovery Timeline

2026-08-25 - CVE-2026-79271 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database
2026-08-27 - EPSS data published for CVE-2026-79271

Technical Details for CVE-2026-79271

Vulnerability Analysis

The vulnerability resides in Chrome's DOM implementation, which manages how HTML documents are parsed, represented, and exposed to JavaScript. An attacker crafts an HTML page that triggers a code path in the DOM that returns or exposes data the requesting origin should not be able to read. Because the leak occurs through legitimate DOM interfaces, the malicious page does not need to escape the sandbox or achieve code execution. The attacker only needs the victim to open the page, which is typically achieved through phishing, malvertising, or a link posted on a trusted platform. Sensitive data that can be leaked from the DOM includes information from other frames, cached responses, or browser state accessible to renderer scripts.

Root Cause

The root cause is improper isolation or validation within a DOM subsystem, allowing an origin to observe information belonging to another security context. This falls squarely under [CWE-200] where a resource returns data to an actor that should not have access to it. Google has not published the internal implementation detail publicly; the fix is tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page, then lures the victim to load it in a vulnerable Chrome build. Once the page executes, embedded JavaScript invokes the affected DOM APIs to read information that should be restricted. No authentication is required and no privileges on the target host are needed. The leaked data can be exfiltrated to attacker-controlled infrastructure through standard outbound HTTP requests.

No public proof-of-concept is currently linked to this CVE. Refer to the Chrome Stable Channel Update and the Chromium Issue Tracker Entry for vendor details.

Detection Methods for CVE-2026-79271

Indicators of Compromise

Outbound HTTPS requests from Chrome renderer processes to newly registered or low-reputation domains shortly after users click external links.
Chrome browser versions reported in asset inventories below 152.0.7977.65 on managed endpoints.
Phishing emails or chat messages containing links that render unexpected HTML with heavy client-side scripting.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag builds earlier than 152.0.7977.65 as vulnerable.
Monitor web proxy and DNS telemetry for user navigation to domains categorized as newly seen, uncategorized, or associated with phishing kits.
Correlate email or messaging gateway URL clicks with subsequent renderer network activity to identify social engineering delivery.

Monitoring Recommendations

Enable browser telemetry through Chrome Enterprise reporting to surface installed version and extension inventory.
Alert on user interaction with links flagged by URL reputation services in real time.
Track process ancestry where chrome.exe spawns unusual child processes or writes files immediately after visiting external sites.

How to Mitigate CVE-2026-79271

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Restart the browser after the update to ensure the patched binary is loaded.
Push the update through enterprise management tooling such as Chrome Browser Cloud Management or MDM policies.

Patch Information

Google addressed CVE-2026-79271 in the Chrome Stable channel with version 152.0.7977.65. Refer to the Chrome Stable Channel Update for the full release notes and the Chromium Issue Tracker Entry for issue tracking. Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, should be updated once vendors ship builds that incorporate the upstream fix.

Workarounds

Deploy user awareness reminders about clicking links from unsolicited email or chat messages until patches are applied.
Restrict access to unclassified or newly registered domains at the web proxy for high-risk user groups.
Enforce Chrome auto-update policies and disable the ability for users to defer critical updates.

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version